{"schema":"threatline.record/2","record":{"id":"CVE-2026-42945","aliases":[],"summary":"NGINX ngx_http_rewrite_module vulnerability","details":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","categories":["Web servers"],"product":"NGINX Plus","vendor":"F5","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42945","source_modified_at":"2026-09-10T12:04:53.533Z","fetched_at":"2026-10-26T06:00:26.954813Z","product":"NGINX Plus","vendor":"F5","versions":[{"status":"unaffected","version":"R37","lessThan":"*","versionType":"custom"},{"status":"affected","version":"R36","lessThan":"R36 P4","versionType":"custom"},{"status":"affected","version":"R32","lessThan":"R32 P6","versionType":"custom"}],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42945","source_modified_at":"2026-09-10T12:04:53.533Z","fetched_at":"2026-10-26T06:00:26.954813Z","product":"NGINX Open Source","vendor":"F5","versions":[{"status":"unaffected","version":"1.31.0","lessThan":"*","versionType":"semver"},{"status":"affected","version":"0.6.27","lessThan":"1.30.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42945","source_modified_at":"2026-09-10T12:04:53.533Z","fetched_at":"2026-10-26T06:00:26.954813Z","package":{"name":"NGINX Open Source","ecosystem":null},"version":"1.30.1","basis":"first unaffected version stated in the CVE record"}],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.68047,"percentile":0.9932,"score_date":"2026-10-25"},"published_at":"2026-05-13T14:12:43.971Z","modified_at":"2026-09-10T12:04:53.533Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-42945","fetched_at":"2026-10-26T06:00:26.954813Z","source_modified_at":"2026-09-10T12:04:53.533Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42945","fetched_at":"2026-10-26T06:00:26.954813Z","source_modified_at":"2026-10-25"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://my.f5.com/manage/s/article/K000161019","tags":["vendor-advisory","patch"]},{"source":"CVE List","url":"https://depthfirst.com/nginx-rift"},{"source":"CVE List","url":"https://github.com/DepthFirstDisclosures/Nginx-Rift"},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-42945","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477116","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42945.json","tags":["x_sadp-csaf-vex"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17790","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:18063","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19159","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:18041","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17791","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17751","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17792","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17793","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17752","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17794","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17753","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:18029","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19371","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19374","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:19372","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:17417","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:22396","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:22393","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:22394","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:22390","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:22388","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:22389","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:22383","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:22382","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20442","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20444","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:58981","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:21275","tags":["vendor-advisory","x_refsource_REDHAT"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-05-13T00:00:00+00:00"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-10T12:04:53.533Z","content_hash":"e0312e159dde732f0783c14fad9677edd3105ba9b0fd945c60c418d947e96f77"}}